Due to frequent timeout errors, we turned off h1 and h2 Talos tests from autoland and inbound. All went fine until backout from [1] caused h1 to run on Windows again.
Investigate how the backout re-enabled them, then shut them down again.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1431533#c47

It's a matter of definition, really -- an action can run a test if it was in the full task graph generated by the decision task. If that task is omitted due to target task selection (which is where run-on-branches is seen) or optimization, that doesn't affect the full-task-graph that the actions are based on. The whole idea of these actions is to override task-graph selection and optimization.
So, if we have tasks that should *never* run on windows, they shouldn't be in the full-task-graph at all, which means a change to the test-sets, rather than run-on-branches.

thanks Dustin- that helps clarify things. We often have tests we want to run on try only until they are stable- is there a better way to support this? I would like to explore other options before removing these tests from a test-set.yml definition, although in a patch to test it we could always add it back.

You could tag the affected tasks with some kind of not_part_of_all_talos_tests=True and not_part_of_missing_tests=True or something like that, and then modify the action implementation to skip tasks with that tag. It does seem like a bit of a hack, though. I assume these are tier-2 or tier-3? If so, won't they just not appear on treeherder anyway?